CVE-2009-0556: Microsoft PowerPoint code injection in OutlineTextRefAtom

CVE-2009-0556 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-01-07

Microsoft PowerPoint is a widely used presentation application. A vulnerability in how it handles specific internal data structures allows an attacker to take full control of a computer if a user opens a specially crafted PowerPoint file. This flaw has been actively exploited in the wild to install malicious software, potentially leading to data theft or complete system compromise.

Technologies: Microsoft Office. Vendors: Microsoft.

Quick answers

Is CVE-2009-0556 exploited in the wild?
Yes. CVE-2009-0556 is known to be exploited in the wild, first recorded on 7 January 2026. Treat it as urgent.
How severe is CVE-2009-0556?
Critical severity, with a CVSS score of 8.8, published 7 January 2026.
Which products and versions are affected?
Microsoft Office 2004 for Mac PowerPoint component; Microsoft PowerPoint 2000 SP3; Microsoft PowerPoint 2002 SP3; Microsoft PowerPoint 2003 SP3.
Is there a fix for CVE-2009-0556?
A patch was published on 2009-06-09: Microsoft released security bulletin MS09-017. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2009-0556 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2009-0556?
Check whether you run Microsoft Office, Microsoft Office 2004 for Mac, Microsoft PowerPoint 2000 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability exists in Microsoft PowerPoint due to improper validation of index values within the OutlineTextRefAtom structure. By crafting a malicious PowerPoint file with an invalid index, a remote attacker can trigger a heap-based memory corruption or code injection (CWE-94). Exploitation requires a user to open the malicious file, typically delivered via email or a malicious website. Successful exploitation allows for arbitrary code execution in the context of the logged-in user. This vulnerability was notably exploited in the wild by the 'Apptom' malware family. Microsoft has released security bulletin MS09-017 to address this issue.

Affected products

  • Microsoft PowerPoint 2000 SP3
  • Microsoft PowerPoint 2002 SP3
  • Microsoft PowerPoint 2003 SP3
  • Microsoft Office 2004 for Mac PowerPoint component

Timeline

  • 2009-04-02: exploited: Exploitation in the wild reported by Microsoft and security researchers.
  • 2009-06-09: patched: Microsoft released security bulletin MS09-017.
  • 2026-01-07: kev added: Added to CISA Known Exploited Vulnerabilities catalog.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.